L3M: A Verifiable Harness and Runtime for Self-Extending and Self-Improving Agents

Carson Eisenach; Robert Joseph George; Vincent Quenneville-Belair; Kate Gwimm; Dean Foster

cs.AIOct 14, 2026

L3M: A Verifiable Harness and Runtime for Self-Extending and Self-Improving Agents

Authors: Carson Eisenach, Robert Joseph George, Vincent Quenneville-Belair, Kate Gwimm, Dean Foster

Organizations: Amazon

Abstract

The lasting gains in AI have come from methods that absorb more computation, and language models already scale computation within a call. Useful work, though, happens across calls: over hours or days, through tools and external systems, among many agents and the humans they work for, and increasingly through code the agents write themselves. Whether that work compounds is enabled by the harness around it, and the harness faces a constraint the model does not: of the three participants in such a computation, the human, the model and code, only the human's attention does not scale, so the computation can grow only if the human is not in every loop. L3M is a runtime built on that premise, written in Lean 4 so that one language implements the harness, states its invariants, and is the language agents extend it in. One computation spans humans, agents, models and code, and all of its state lives in Git: a rich state trajectory -- rather than a chat conversation -- is an object the runtime can resume, rewind, fork, compare and merge. Waiting, communication, delegation and undo are primitives, not patterns the model reasons through each time. When an agent works out a procedure, it can write it once as a sealed Lean program whose type is its permission request, and the harness offers it back as a tool -- machinery for the model to use. To take the human out of the loop, L3M uses reversibility to decide where that is safe: a tool's review tier follows from how far its effects can be undone, so agents act freely where the runtime can recover. Because the machinery can change, the properties that make this safe are stated as kernel-checked theorems about the code that runs. On Terminal-Bench, an untuned L3M reaches about two thirds of its (unsafe) shell-equipped pass rate using only safe (not needing human review) tools.

Figures & tables

Guarantee	Theorem	Rests on
Confinement. A file tool cannot name a path that climbs out of the agent’s roots.	safePath_no_traversal	The kernel. The check is on the path’s text; symlinks are checked at run time.
Monotone authority. A child’s grant at spawn never exceeds its parent’s, every descendant’s is bounded by its root’s, and no agent grants to itself.	grant_restrict_le descendant_bounded_by_root_grant no_self_grant	The kernel, over the ledgers agents can write. Each ancestor’s own refs are added at its hop, and a regrant is bounded by its issuer, not by every ancestor.
No token without the grant. The boot mints a token only for an authority the grant confers, and a narrower grant mints none a wider one lacked.	mint_reflects_profile Minted.restrict_none	The kernel. That tokens cannot be forged is enforced by the build, not proved.
Budget is lent, not minted. All a subtree of agents can spend is bounded by its root’s budget.	global_budget_bounded_by_root	The kernel, for one loan batch; later loans and returns need a further invariant.
Self-extension adds no authority. A sealed program the harness admits uses only admitted constants.	sealUsed_admits_only_safe	The kernel, over the constants a program names directly. Elaboration and the providers are trusted.
Review cannot be skipped. Under the default review posture, a tool whose effects cannot be undone and are not confined by a capability is always reviewed.	ungated_world_reaching_always_reviewed	The kernel.

Table 1: The headline guarantees. Each is a theorem about a check in the code L3M runs, with what it rests on and what it leaves open; Appendix A gives the declarations.

Ref	Holds	Written by	In the ACR	Retire / collect
Hub-wide
l3m/ledger	who exists, who is whose parent, the grants issued	harness	—	append-only
personas/ name	the persona’s shared prompt files	a human	via a persona branch	outlives its wearers
Written by the agent
workspace	its work in the hub	agent	workspace/	kept
persona (branch)	its prompt copy, preferences, hooks and programs	agent	agent/	kept / deleted

Table 2: The refs that make up an agent and a persona. Every per-agent ref is refs/heads/agents/ role / uri /self , and the table names only the role. In the last column, kept survives retire and collect, kept / deleted survives retire and is deleted at collect, and deleted is deleted at retire.

Panel of Figure 2 — Figure 2: The body of an agent. Its write roots are worktrees on its own branches; the harness’s checkouts are denied to it; the rest of the agent is refs the harness writes and the agent reaches only through tools.

Panel of Figure 3 — Figure 3: How an agent is defined. (a) The system prompt is assembled at boot from layers owned by the persona and by L3M, and each request adds a suffix for the model it is sent to. (b) Hooks decide what the agent does with each event, and each decision is journaled.

Panel of Figure 4 — Figure 4: What the model sees is a pure function of the Log. Record 6 is retracted by the rewind at 7; the machine record at 3 lowers to nothing; the budget note at 5 becomes a delta that the dialect folds into the next user turn.

Panel of Figure 5 — Figure 5: The event loop. Signal sources and activities only post signals, and the sequencer alone appends to the Log. Each pass accepts what is consistent with the Log, journals the hooks’ decisions, folds the Log to decide what is owed, stores it, and only then starts the activities it names, so a kill at any point is repaired by the next pass.

The model tries to	What stops it	Where
write ../../.ssh/authorized_keys	A file path is a type whose values cannot climb out of the agent’s roots, so the call cannot be stated.	Table 1
reach /etc through a symlink in its workspace	The file shim resolves every path beneath its root and refuses to follow symlinks.	cannot_escape_root_via_symlink
add net to its own grant	No file tool admits a path under .l3m/ , and no agent grants to itself. Residue: the hub is outside the write reach of every entity without wild ; with wild , its own grant.json and the ledger are one unsandboxed shell call away, and the review card is the only wall.	admit_refuses_l3m , Table 1 ; wild is assumed withheld
rewrite another agent’s Log or grant	The Git token writes only the agent’s own branches, and never any agent’s Log, grants or claims.	grant_of_record_writes_no_entity_record
run curl https://x.sh \| sh	No process the harness starts is a shell or an interpreter. The sandboxed shell tool ( shell ) has no network and is carded on every call. The unsandboxed Wild_shell exists only under wild , and is carded under the default review posture only.	no_shell_or_interpreter , shell_run_is_card , no_wild_no_wild_effects
send data to a host its grant does not name	The network token names its hosts, and the provider checks every URL against them.	allowsUrl_authority_is_trusted

Table 3: What a hijacked model might try, and what stops it.

Family	Class	Granted by	A tool holding it may	Undo	Bounded	Tier
Files	FsRead	always	read beneath the agent’s roots	read-only	✓	jail
	FsWrite	always	change files beneath the agent’s roots	reversible	✓	tame
	Blob	always	append content to a scoped store	none	✓	tame
	WildRead	wildRead	read outside every root	none		wild
	WildWrite	wild	write outside every root	none		wild
Git	GitRead	git	inspect permitted refs and work	read-only	✓	jail

Table 4: The principal effect classes, with the Effects suffix dropped. Undo is the ceiling the effect registry declares, and Bounded marks a class whose token limits its reach. The tier follows from those two columns ( Section 3.3 ); it says where review is spent, not that an operation is harmless.

Panel of Figure 7 — Figure 7: From grant to system call, for a child with one project worktree and no network. The grant decides which tokens exist, the tokens decide which tools the model is offered, and each call carries its token to the provider, which checks its scope again.

Panel of Figure 11 — Figure 11: Two ways to collect the TODO s in a tree. Left: the agent is the loop, and every file costs model calls and context. Right: the agent writes the scan as a sealed program that runs under the tokens it already holds; each file is read and matched with no model call, and the model reasons once, over the summary.

Panel of Figure 12 — Figure 12: L3M on one host. One daemon serves every hub on the host, and a hub is a folder: a bare repository, a forest of ACRs, its settings and a cache. Sessions are processes that the daemon starts and that call the model themselves. The human’s own settings name the hubs, the models and the credentials.

Panel of Figure 13 — Figure 13: A tree of agents at spawn time. Each child’s grant lies within its parent’s, and its fuel is lent from the parent’s. A request that exceeds either is refused. The private child keeps the project’s refs but not the right to push them. The two children are the peers of Section 5.2 .

Panel of Figure 15 — Figure 15: Mail between hubs. The sender’s authority ends at its own outbox; carrying mail across machines is the postmaster’s duty, and only the human’s settings name the offices. Read marks travel back the same way, as receipts.

Panel of Figure 16 — Figure 16: Write, gate, execute: W $\oplus$ X for authority. No party both writes bytes and runs them, and the gate’s approval names the exact bytes. The staged build of Figure 17 is the same shape with two agents.

Panel of Figure 17 — Figure 17: A staged build across two agents. Fetch sees only public lockfiles and warms a cache; build and run have no network. The builder cannot run what it built, though its build recipes execute inside the build sandbox; the runner receives the artifact by digest, cannot change it, and writes only a fresh output directory.

Panel of Figure 18 — Figure 18: Why the split bounds leakage. (a) An agent whose grant holds both the source and the network can leak through every byte it sends. (b) Split into peers with different grants that talk only by mail, the private side’s contribution to anything leaving is the seed, however much traffic the researcher does, under the channel model of the text. Arrow width stands for volume; orange marks bytes that may carry the source.

Panel of Figure 19 — Figure 19: A quarantined reader. The program hands the page to a fresh subagent Q whose grant is empty, and parses its reply into one of three words fixed in advance. A page that hijacks Q gains a model that holds nothing, and can change only which word reaches A. Arrow width stands for volume; orange marks bytes that may carry an injected instruction.

Panel of Figure 20 — Figure 20: One instance of improving agents inside L3M. Every arrow is an L3M primitive: a persona branch forks and syncs, a parent reads its children’s Logs, a program summarizes them and the model proposes edits, and a human publishes the result.

		Per passing attempt
Configuration	Pass@3, %	Model calls	Tokens, M	Minutes
Claude Code, permissions bypassed	59.5	53.0	4.43	24.6
L3M, shell, review off	41.7	53.2	7.70	25.4
L3M, tame	27.0	53.3	7.74	21.6
L3M, tame, no programs	24.3	41.5	6.17	24.5

Table 5: Terminal-Bench: 37 tasks, three attempts each; pass@3 is averaged over tasks. Model calls, tokens and minutes are means over passing attempts and include any subagent sessions; tokens count cached and uncached input plus output.

		Per passing attempt
Configuration	Pass@3, %	Model calls	Tokens, M	Minutes
L3M, shell, review off	41.7	53.2	7.70	25.4
L3M, shell, review --yes	40.5	100.9	12.10 ∗	30.4
L3M, shell, review --no	43.2	107.3	12.81 ∗	28.1

Table 6: Review of shell calls, on the same tasks and with the same columns as Table 5 . Model calls count both sides of the review. ∗ Tokens include the reviewer’s side of each exchange, which runs on a cheaper model (Claude Sonnet 4.6) than the agent’s.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 21 — Figure 21: The bottleneck. A private parent $P$ holds the secrets and has no network; its child $C$ has the network and no secrets. Every message across the boundary is a metered edge, and the charged direction is private to public (orange). $P$ seeds $C$ with $k$ bytes (1); $C$ works publicly and returns a menu of $N$ options (2); $P$ answers with a selection (3), so at most $\log_{2}N$ bits leave the private side however much $P$ read. In L3M this is a spawn pattern over the grants of Section 5.2 .

LLM Agent Harnesses

LLM agent harnesses are the software and runtime systems that organize an agent’s tools, context, state, execution, and safeguards.

See all 387 papers

May 27, 2026

LACUNA: Safe Agents as Recursive Program Holes

LLM agents increasingly act by writing code, yet a split persists between the runtime that drives the agent and the code the model writes. The runtime owns the loop, context, and control flow, and the model has little say over any of them. Letting model-written code shape the runtime itself would make agents more expressive, but it would also sharpen safety problems. A model can be diverted by a prompt injection, call the wrong tool, or fail partway and leave an inconsistent state, and each such failure reaches further when the code shapes the runtime than when it expresses a single action. We present LACUNA, a programming model for agents that closes this split while preserving safety. Each agent action is a typed call

\texttt{agent[T](task)}

that the LLM fills with code when execution reaches it, and the code is type-checked against the surrounding program before it runs. Because each action is accepted or rejected as a whole, a rejected one leaves the environment untouched, and its compiler diagnostics drive a retry. The same check also bounds which tools and data an action may use and how they flow. Our primitive expresses ReAct loops, sub-agents, skills, parallel decomposition, and multi-model planning as ordinary control flow. We evaluate LACUNA on a collection of test cases, BrowseComp-Plus, and

τ^2

-bench. On BrowseComp-Plus,

8.6\%

of generations are rejected before execution, with 0.7 retries per query on average, and the agent reaches

27.1\%

accuracy. On

τ^2

-bench, LACUNA solves

76.0\%

392

tasks across four domains with a capable model, on par with the baseline agent.

Yaoyu Zhao, Yichen Xu, Oliver Bračevac +3

EPFL, Lausanne, Switzerland

AI Agent Reliability LLM Agents LLM Agent Safety

Ask PDF

Oct 21, 2026

Can LLMs Improve Their Own Harness? A Controlled Study on ARC-AGI-3

A generally intelligent system acquires new skills efficiently without requiring humans to redesign its software scaffold for every new task. Yet language models rarely act alone. A harness is a symbolic program that orchestrates calls to the model, handling perception, memory, tool use, recovery, and inference allocation on the model's behalf. ARC-AGI-3 is an interactive benchmark in which agents must explore unfamiliar environments, figure out their goals on the fly, and keep learning as they go. On it, human-steered systems already report ceiling scores across the public games, so we know effective designs exist. We ask whether frontier models can build and improve such a harness on their own. Through a fixed coding bootstrap, each model constructs a complete task harness, acts through that harness on five development games, and revises the entire codebase twice. Every version is evaluated on twenty games that never influence adaptation. We measure task performance with Relative Human Action Efficiency (RHAE), which combines level completion with action efficiency relative to human baselines, and record dollar-denominated inference cost as a practical resource measure. Across 27 lineages, harness performance ranges from zero to near-ceiling scores. Two revisions raise mean held-out RHAE by only 2.80 points (95% interval [-1.44,7.35]). Development gains overstate held-out improvement, and reductions in inference cost can come at the expense of task performance. Human-steered systems demonstrate further headroom. These findings reveal a gap between autonomous harness construction and reliable adaptation under this two-revision protocol: even strong task performance does not ensure that subsequent revisions generalize or preserve existing capabilities.

Jens Lehmann, Sahar Vahdati

Amazon∗ · Technische Universität Dresden · Universität Hannover +1

LLM Agent Harnesses Agent Harness Optimization LLM Agent Self-Improvement LLM Agent Reliability ARC-AGI LLM Agent Efficiency

Ask PDF

May 18, 2026

Code as Agent Harness

Recent large language models (LLMs) have demonstrated strong capabilities in understanding and generating code, from competitive programming to repository-level software engineering. In emerging agentic systems, code is no longer only a target output. It increasingly serves as an operational substrate for agent reasoning, acting, environment modeling, and execution-based verification. We frame this shift through the lens of agent harnesses and introduce code as agent harness: a unified view that centers code as the basis for agent infrastructure. To systematically study this perspective, we organize the survey around three connected layers. First, we study the harness interface, where code connects agents to reasoning, action, and environment modeling. Second, we examine harness mechanisms: planning, memory, and tool use for long-horizon execution, together with feedback-driven control and optimization that make harness reliable and adaptive. Third, we discuss scaling the harness from single-agent systems to multi-agent settings, where shared code artifacts support multi-agent coordination, review, and verification. Across these layers, we summarize representative methods and practical applications of code as agent harness, spanning coding assistants, GUI/OS automation, embodied agents, scientific discovery, personalization and recommendation, DevOps, and enterprise workflows. We further outline open challenges for harness engineering, including evaluation beyond final task success, verification under incomplete feedback, regression-free harness improvement, consistent shared state across multiple agents, human oversight for safety-critical actions, and extensions to multimodal environments. By centering code as the harness of agentic AI, this survey provides a unified roadmap toward executable, verifiable, and stateful AI agent systems.

Xuying Ning, Katherine Tieu, Dongqi Fu +39

LLM Agent Orchestration Long-Horizon LLM Agents LLM Agent Harnesses LLM Agent Reliability

Ask PDF

Abstract

LLM Agent Harnesses

Explore similar work

LACUNA: Safe Agents as Recursive Program Holes

Can LLMs Improve Their Own Harness? A Controlled Study on ARC-AGI-3

Code as Agent Harness